diff options
author | Henrique de Moraes Holschuh <hmh@hmh.eng.br> | 2010-02-25 20:22:22 -0500 |
---|---|---|
committer | Henrique de Moraes Holschuh <hmh@hmh.eng.br> | 2010-02-25 20:22:22 -0500 |
commit | b525c06cdbd8a3963f0173ccd23f9147d4c384b5 (patch) | |
tree | 025b22fda39fc7a42061ab25a908abe3ae757d3b /Documentation | |
parent | 08fedfc903c78e380b0baa7b57c52d367794d0a5 (diff) |
thinkpad-acpi: lock down video output state access
Given the right combination of ThinkPad and X.org, just reading the
video output control state is enough to hard-crash X.org.
Until the day I somehow find out a model or BIOS cut date to not
provide this feature to ThinkPads that can do video switching through
X RandR, change permissions so that only processes with CAP_SYS_ADMIN
can access any sort of video output control state.
This bug could be considered a local DoS I suppose, as it allows any
non-privledged local user to cause some versions of X.org to
hard-crash some ThinkPads.
Reported-by: Jidanni <jidanni@jidanni.org>
Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Cc: stable@kernel.org
Diffstat (limited to 'Documentation')
-rw-r--r-- | Documentation/laptops/thinkpad-acpi.txt | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt index 75afa1229fd7..39c0a09d0105 100644 --- a/Documentation/laptops/thinkpad-acpi.txt +++ b/Documentation/laptops/thinkpad-acpi.txt | |||
@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The following commands are available: | |||
650 | echo expand_toggle > /proc/acpi/ibm/video | 650 | echo expand_toggle > /proc/acpi/ibm/video |
651 | echo video_switch > /proc/acpi/ibm/video | 651 | echo video_switch > /proc/acpi/ibm/video |
652 | 652 | ||
653 | NOTE: Access to this feature is restricted to processes owning the | ||
654 | CAP_SYS_ADMIN capability for safety reasons, as it can interact badly | ||
655 | enough with some versions of X.org to crash it. | ||
656 | |||
653 | Each video output device can be enabled or disabled individually. | 657 | Each video output device can be enabled or disabled individually. |
654 | Reading /proc/acpi/ibm/video shows the status of each device. | 658 | Reading /proc/acpi/ibm/video shows the status of each device. |
655 | 659 | ||